maintaincereminder[.]wasmer[.]app

This domain, maintaincereminder.wasmer.app, has been identified as a phishing site specifically targeting Navy Federal Credit Union members. The infrastructure is currently offline but was actively impersonating the financial institution's branding, including the use of the official page title 'Navy Federal Credit Union - Our Members are the Mission®.' The threat type is classified as credential harvesting, a common tactic used to steal login credentials and sensitive financial information from unsuspecting users. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was flagged by 22 of 95 security vendors on VirusTotal, indicating widespread detection as a phishing threat. It resolves to the IP address 62.210.172.150, located in France, and appears on at least one security blocklist. The domain was registered through Squarespace Domains II LLC, a registrar frequently utilized for both legitimate and malicious purposes. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while providing encryption, does not validate the legitimacy of the site's content. No creation date is provided, but the presence of a Let's Encrypt certificate suggests recent activity. The current status of maintaincereminder.wasmer.app is offline, reducing immediate risk to users. However, the infrastructure may be reactivated or repurposed for future campaigns. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with this domain should immediately change their Navy Federal Credit Union credentials and monitor accounts for unauthorized activity. Security teams should review logs for connections to 62.210.172.150 and the domain to identify potential compromise. Proactive measures, such as implementing multi-factor authentication and conducting user awareness training on phishing threats, are recommended to mitigate similar risks in the future.